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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


All children of course develop at varying rates but we still must 
consider that there are generally accepted stages which is 
reflected across education, the law and social norms. 


It is our view that this is more about respecting their eventual 


autonomy and considering differing needs rather than a heavy- 
handed age-banded approach. 
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Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 


Children’s development is not specific to the digital environment 
but rather must be considered as an overall consideration of their 
critical thinking skills and understanding at each stage of their 
development. 


We need to consider as a priority their capacity to make informed 
choices, understand instructions and an ability to understand the 
implications of the use of their data. Ditch the Label feels that the 
different age groups suggested by the Commissioner takes this 
broadly into account and allows for their development rhoiugh 
each stage. 


The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


Article 3 states that in all actions concerning children, “the best 
interests of the child shall be a primary consideration.” Although it 
must be said that digital technologies are not yet recognised it is 
widely understood that rights are not context specific. 


Additionally: 


Article 14 - promotes “the full respect of children as rights 
holders” and that their best interests may be “the paramount 
consideration.” 

Article 20 - implementation of the rights should take into account 
“children’s development and their evolving capacities.” 

Article 20 also reminds us that policies often fail to address 
adolescents. This is a vital time in their life and mistakes here can 
have huge implications of their mental health, development and 
wellbeing. 


There are various other articles that address children’s right not 


to be discriminated against and to allow them to express their 
views in regard to matters which concern them and to have 
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freedom of expression and to seek, receive and impart 
information and ideas of all kinds. 

Children are also provided with the right to rest and leisure time 
and the right to be protected from information / material that is 
injurious to their wellbeing. (Article 17) 


It is addressed in article 5 that parents have the duty, right and 
responsibility to provide care and direction in response to their 
evolving capacities. 


In 2017 the UNHRC clarified that a child is any person aged under 
18 and that when forming a data protection code for children their 
best interests are of paramount consideration. 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 

e default privacy settings, 

e data minimisation standards, 

e« the presentation and language of terms and conditions and privacy 
notices, 

e uses of geolocation technology, 

e automated and semi-automated profiling, 

e transparency of paid-for activity such as product placement and 
marketing, 

e the sharing and resale of data, 

e the strategies used to encourage extended user engagement, 

e user reporting and resolution processes and systems, 

e the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 

e the ability to access advice from independent, specialist advocates 
on all data rights, and 

«e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 


Q5. Please provide any views or evidence you have on the following: 
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Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


Q5D. examples of ISS design you consider to be good practice. 
Default privacy settings: 


Such settings determine the extent to which and where a child’s 
data is processed (advertising, other customers, clients, public 
authorities, third sector, commercial companies). 

The settings also dictate how personal data is processed, 
collected, used, shared, and for how long. 


Default privacy settings should be standard and of the highest 
privacy settings before a user chooses to change them. Children in 
particular rarely change such settings (so they should as a 
standard be of the highest) and view constant tick boxes of 
consent to be a nuisance so they rarely read them. Having privacy 
settings set as the highest possible level as default will take away 
the often cumbersome task of ensuring children do this 
themselves. 


Tech updates should also take this into account and NOT default 
back to low privacy settings. 


We know from our work that children often don’t understand the 
concept of data privacy and that T&C’s from many websites are 
aimed at someone with an undergraduate degree with little 
consideration for children’s understanding. 


Children are also often shocked at the lack of online privacy and 
assume most of their ‘online life’ is private. They usually do not 
realise that social media companies routinely monitor and collect 
their data and usage. 


It should not fall upon children to evaluate the consequences of 


data protection upon their future when often, several years of 
data processing will have occurred before they reach that skill set. 


V1.0 20180626 


Many children are often unaware of the difference between a 
public and private profile and the onus should not fall upon their 
shoulders when little is currently known about potential long-term 
consequences. 


With many young people having a digital footprint from before 
birth it in inherently unfair to hold and share such information. 
The DCMS’s Secure by Design (2018) report found that privacy 
settings were given far too low priority and that expectations 
were placed on consumers in this area and usually the language 
was not age appropriate. 


Children are often unaware of risk and parents often have gaps in 
knowledge regarding practical application of usage. Children 
should be given frequent option to delete data and data should be 
deleted on closing an app. 


T&C’s should be available in the plainest of language and age 
appropriate for all users as they often have no idea what they are 
signing up to and there should be an ‘opt-in’ rather than an ‘opt- 
out’ option. 


The current system of “take it or leave it” on T&C’s means many 
children simply sign up rather than be locked out of a service. 


Tracking of users’ location even when they are not using the app 
should not be a default setting and often children have no idea 
that their location is even being tracked. 


Given how vulnerable children are to advertising, transparency 
should be standard on paid-for-content, marketing and product 
placement from commercial companies so they are easily able to 
identity it. 


QS5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


Education (along the lines of media information literacy) written 
into education as standard and revisited at different stages of 
education. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 
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Name: ME 
Email: 


Brief summary of what you think you could offer: Ditch the Label 
work with thousands of young people every month who are 
impacted on all levels of their life by digital technology. Our 
insight and experience is extensive and we would welcome 
continued involvement to benefit the lives of children and young 
people. 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 
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Commercial companies will often tell you that ‘kids 
understand the online world’ but our direct experience 
is that they are frequently impacted. The commissioner 
should have children front and centre of this and not 
commercial driven companies. 


We support 5Rights suggested guiding principles: 


« In determining standards and what measures 
must be taken, the best interests of the child 
must be the paramount consideration 

« A high bar of privacy by default; i.e. safety by 
design, privacy by design and high privacy by 
default should be the norm for all products and 
services’ features and functionalities /ikely to be 
accessed by children 

« Responsibility for data protection rests with 
online services, not the child 

e Responsibility for enforcement rests with the 
regulator, not the child 

« The impact of service design on children (under 
18) must be considered in advance 

« The Code must reflect and/or enhance, never 
lessen, existing regulations, legislation, 
international agreements and cultural norms that 
protect children in other contexts, by 
incorporating and applying them so that they are 
enforceable in the digital environment 

« The Code must give clarity to the General Data 
Protection Regulation’s (“GDPR”) assertion that 
“children merit specific protection” 

« The Code must reflect and address the needs and 
concerns articulated by children themselves 

« That children have different needs at different 
ages and stages of development and these must 
be considered when designing services 

e Online services have a duty to uphold the spirit as 
well as the letter of the Code 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 

We are an anti-bullying charity and work with 
children / young people aged 12-25 


A body representing the views or interests of parents? 
Please specify: 

As a secondary area of our work regarding the 
above 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 
We provide support via our online community 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 


Other? 
Please specify: 


Thank you for responding to this call for evidence. 
We value your input. 
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